CVSS: 7.8EPSS: 3%CPEs: 20EXPL: 0CVE-2014-2745
https://notcve.org/view.php?id=CVE-2014-2745
Prosody before 0.9.4 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack, related to core/portmanager.lua and util/xmppstream.lua. Prosody anterior a 0.9.4 no restringe debidamente el procesamiento de elementos XML comprimidos, lo que permite a atacantes remotos causar una denegación de servicio (consumo de recursos) a través de una cadena XMPP manipulada, también conocido como una ataque "xmppbomb", relacionado con core/portmanager.lua y util/xmppstream.lua. • http://blog.prosody.im/prosody-0-9-4-released http://hg.prosody.im/0.9/rev/1107d66d2ab2 http://hg.prosody.im/0.9/rev/a97591d2e1ad http://openwall.com/lists/oss-security/2014/04/07/7 http://openwall.com/lists/oss-security/2014/04/09/1 http://secunia.com/advisories/57710 http://www.debian.org/security/2014/dsa-2895 http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.8EPSS: 3%CPEs: 21EXPL: 2CVE-2014-2744
https://notcve.org/view.php?id=CVE-2014-2744
plugins/mod_compression.lua in (1) Prosody before 0.9.4 and (2) Lightwitch Metronome through 3.4 negotiates stream compression while a session is unauthenticated, which allows remote attackers to cause a denial of service (resource consumption) via compressed XML elements in an XMPP stream, aka an "xmppbomb" attack. plugins/mod_compression.lua en (1) Prosody anterior a 0.9.4 y (2) Lightwitch Metronome hasta 3.4 negocia compresión de cadena mientras una sesión no está autenticada, lo que permite a atacantes remotos causar una denegación de servicio (consumo de recursos) a través de elementos XML comprimidos en una cadena XMPP, también conocido como un ataque "xmppbomb". • http://blog.prosody.im/prosody-0-9-4-released http://code.lightwitch.org/metronome/rev/49f47277a411 http://hg.prosody.im/0.9/rev/b3b1c9da38fb http://openwall.com/lists/oss-security/2014/04/07/7 http://openwall.com/lists/oss-security/2014/04/09/1 http://secunia.com/advisories/57710 http://www.debian.org/security/2014/dsa-2895 http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas • CWE-20: Improper Input Validation •